Fake McAfee download links

We've received several reports of emails, warning about a new virus called "Kongo31.XRW" (which doesn't exist). The email links to a fake McAfee site, hosted in Canada. The download link gets you a file called ak26xrw-patch-installer-win32.exe - which (surprise, surprise!) is infected with Trojan-Downloader.Win32.Hanlo.h. F-Secure : News from the Lab - December of 2005